Two things: 1) In the syslog.conf entry you included the "local2.*" is separated from "/var/adm/sudo.log" by spaces but it needs to be tabs only. 2) I'd suggest using "local2.debug" not "local2.*" So, the line should be: local2.debug /var/adm/sudo.log It is very important to use tabs and not spaces in syslog.conf. - todd